sdtoto Platform Privacy Notice
This page describes what we collect when you use sdtoto and how we keep that data protected. We at sdtoto collect personal information—your name, email, phone number, payment details, and identity documents—to provide our gaming and sportsbook service, process deposits through DANA, e-wallet, mobile banking, local payment, online payment, e-wallet, mobile banking, local payment, online payment, or e-wallet, and comply with anti-fraud regulations.
We encrypt your data, store it securely, and do not sell it to third parties. Our privacy policy applies to all users of sdtoto regardless of location—whether you're in Jakarta, Surabaya, Bandung, Medan, Semarang, Yogyakarta, or elsewhere. We are transparent about what we collect, why we collect it, and how long we keep it. This notice explains your rights and our obligations.
If you have questions about how we handle your data, contact our privacy team at the address provided at the end of this notice.
What We Collect and Why
Information You Provide to sdtoto
When you register on sdtoto, you provide an email address, phone number, and a password. We use this information to create your account, send you important notices, and help you recover access if you forget your password. Your email is also used for marketing communications (if you opt in) and notifications about promotions or service updates.
When you deposit funds into sdtoto through DANA, e-wallet, mobile banking, local payment, online payment, e-wallet, mobile banking, local payment, online payment, or e-wallet, we collect the amount, date, time, and payment method. This payment data is used to process your deposit, match it to your account, and comply with anti-money-laundering (AML) regulations. We do not store your payment credentials—your bank or e-wallet provider handles that.
Identity Verification (KYC) Data
Before your first withdrawal from sdtoto, we ask for Know-Your-Customer (KYC) verification. We collect a copy of your government-issued ID (passport, driver's license, national ID card), proof of address (utility bill, bank statement, lease), and sometimes a selfie of you holding your ID. We use KYC data to verify your identity, confirm you are of legal age, and prevent fraud and money laundering.
KYC documents are encrypted and stored separately from your gaming account in a secure vault. We retain KYC data for the period specified by applicable law (typically 5–7 years) for regulatory audit and dispute resolution. After that period, we delete it securely unless legal hold applies. We do not share KYC documents with third parties outside our compliance workflows.
Your payment data is encrypted end-to-end
We use industry-standard encryption to protect payment information. Your mobile banking, local payment, online payment, or bank details are never stored in plain text on our servers.
Gaming and Behaviour Data
We collect data about the games you play, bets you place, and outcomes. This includes the timestamp, game type (slot, live-dealer blackjack, Liga 1 sportsbook), bet amount, and result. We use this data to provide the service, detect cheating or fraud, understand player preferences, and improve our game selection and user experience. We do not use gaming data for marketing unless you consent.
Technical and Device Data
When you access sdtoto on your Android or iOS device—or via a browser on desktop—we collect technical information: your device type, operating system, browser version, and IP address. We use this data to troubleshoot technical issues, prevent fraud, and ensure our platform performs well across devices. We do not use device data to track your location beyond determining your jurisdiction for service eligibility.
Cookies and Tracking
We at sdtoto use cookies to remember your login status, language preference, and betting history. Cookies are small text files stored on your device. We use session cookies (cleared when you log out) and persistent cookies (which stay longer to improve your experience). You can disable cookies in your browser settings, but some sdtoto features may not work properly without them.
How We Use and Protect Your Data
Our sdtoto Data Security Practices
We at sdtoto encrypt sensitive data using TLS (Transport Layer Security) during transmission and AES-256 encryption at rest. Our servers are firewalled and monitored 24/7. We limit employee access to personal data to those who need it for their role. We do not share your data with third parties except where required by law or to provide the service (for example, payment processors and compliance officers).
Our data centers may be located outside your jurisdiction. By using sdtoto, you consent to your data being transferred to and stored in countries other than your country of residence. These countries may have different data protection laws than your home country. We apply the same security standards globally regardless of server location.
Third-Party Processors
We at sdtoto use third parties to process certain data on our behalf: payment processors (who handle DANA, e-wallet, mobile banking, local payment, online payment, e-wallet, mobile banking, local payment, online payment, e-wallet transactions), email providers (who send notifications), and analytics providers (who help us understand user behaviour). Each third party is contractually required to protect your data and use it only for the purposes we specify. We do not sell your data to marketers or data brokers.
How Long We Keep Your Data
- Account data (name, email, phone): We retain this for the lifetime of your sdtoto account and for 5 years after closure.
- Payment records: We keep these for 7 years for accounting and regulatory compliance.
- KYC documents: We retain these for 5–7 years as required by law.
- Gaming history: We retain game records for the lifetime of your account and 2 years after closure.
- Cookies: Session cookies expire when you log out; persistent cookies expire after 12 months of inactivity.
Your Rights and Data Subject Requests
Depending on your jurisdiction, you may have the right to access, correct, or delete your personal data on sdtoto. You may request a copy of the data we hold about you. You may ask us to update or delete information if it is incorrect or no longer needed. You may withdraw consent for marketing communications at any time by clicking the unsubscribe link in emails or contacting us.
To exercise any of these rights, contact our privacy team via email with your request and account details. We will respond within 30 days. If your request is complex or requires verification, we may take up to 60 days. We may request additional information to confirm your identity before fulfilling your request.
We at sdtoto believe your data is yours. We hold it in trust, encrypt it carefully, and share it only where necessary to provide the service or comply with law.
Children and Minor Data
We at sdtoto do not knowingly collect data from individuals below the legal age of majority in their jurisdiction. If you believe we have collected data from a minor, contact our privacy team immediately and we will delete that data.
Policy Updates and Changes
We may update this privacy policy from time to time to reflect changes in our practices or applicable law. We will notify you of material changes via email or by posting an updated notice on sdtoto. Continued use of sdtoto after changes constitute acceptance of the updated policy. Your most important protections—encryption, non-sale of data, and your rights to access and delete—are core principles we do not change.
Contact Our Privacy Team
If you have privacy questions, concerns, or requests, contact our privacy team:
- Email: Send enquiries to our support email address with "Privacy Request" in the subject line.
- Response time: We aim to respond within 30 days for routine enquiries and up to 60 days for complex data subject requests.
- Live chat: Use our live-chat support to request escalation to our privacy officer during business hours.
We at sdtoto are committed to handling your personal data with care, transparency, and respect. Whether you're funding your account via mobile banking, verifying your identity for withdrawal, playing slot games, or betting on Liga 1 football, your privacy is our responsibility. We encrypt your information, limit access, and comply with applicable data protection laws. If you have concerns or questions, reach out—we are here to help.
Legal and Jurisdiction Details
Service availability
We at sdtoto provide our gaming and sportsbook service only in jurisdictions where local law permits online gaming, casino games, live-dealer tables, and wagering. We do not knowingly operate in jurisdictions where such services are prohibited or restricted by statute or regulation. Your access to sdtoto depends on your geographic location at the time you attempt to register or log in. If you are in a jurisdiction where our service is not legal under local law, you will not be able to create or maintain an account with us.
We continuously monitor regulatory developments and adjust our geographic availability accordingly. If local law changes in a way that restricts our service in a jurisdiction where you have an existing account, we will notify you via email and provide a reasonable grace period for you to verify your account status and withdraw any remaining balance, subject to applicable law. Our service terms specify which regions we currently serve. If you are unsure whether sdtoto is available in your location, you should verify our current service area before attempting to register.
Our payment partners—DANA, OVO, GoPay, ShopeePay, LinkAja, QRIS for e-wallets and BCA, Mandiri, BRI, BNI for bank transfers—also operate under their own licensing and geographic restrictions. If a payment method is unavailable in your jurisdiction, it reflects both sdtoto's operational scope and your payment provider's service area. Before you attempt to deposit or withdraw, confirm that both sdtoto and your chosen payment method are available in your location.
Account eligibility
To use sdtoto and access our gaming services, you must be of legal age in your jurisdiction to enter into binding contracts and to engage in online gaming activities. Most jurisdictions that permit online gaming require participants to be 18 or older; some require age 21 or higher. You are solely responsible for knowing and complying with the age requirement applicable in your jurisdiction. When you register on sdtoto, you certify that you meet the applicable age threshold. We do not conduct independent age verification at account creation; we rely on your truthfulness at registration and on identity documents you provide during Know-Your-Customer (KYC) verification and withdrawal requests.
You must also be of sound mind and legal capacity to enter into contracts. If you are subject to a court order, legal incapacity, or bankruptcy proceedings that would prevent you from entering binding agreements, you are not eligible to use sdtoto. You are responsible for ensuring your own eligibility before you register, deposit funds, or engage in any activities on our platform.
During your first withdrawal request on sdtoto, we conduct KYC verification. We will request a government-issued ID, proof of address, and sometimes a photo of you holding your ID for identity confirmation. If your documents show you are below the legal age to game in your jurisdiction, or if you cannot provide valid documentation, we will deny your withdrawal and may close your account. Any deposits made prior to closure would be held in escrow pending your appeal or submission of corrected documentation proving eligibility.
Local-law responsibility
We at sdtoto operate only where local law permits our services. However, gaming laws are complex, vary significantly by jurisdiction, and change over time. You are solely responsible for verifying that your use of sdtoto complies with the laws and regulations of your own jurisdiction before you register, deposit, or engage in any activity on our platform. We do not provide legal advice, and we do not represent that sdtoto is legal everywhere it is geographically accessible.
If you are uncertain about the legality of online gaming, sportsbooks, or live-dealer tables in your jurisdiction, you should consult a local attorney or contact your regional gaming regulator before using sdtoto. Do not assume that because sdtoto's website loads in your location that it is legal for you to use it. Conversely, do not assume it is illegal simply because sdtoto is not marketed in your region. Verify the actual legal status in your jurisdiction with authoritative sources.
If a jurisdiction declares online gaming or sportsbooks illegal after you have opened an sdtoto account, you are responsible for ceasing use and withdrawing your balance in compliance with local law. We will not be liable for any legal consequences you face as a result of your continued use of sdtoto after it becomes prohibited in your location. However, we will make reasonable efforts to notify you if access becomes unavailable in your jurisdiction and will provide a grace period for fund withdrawal where legally feasible.
Data and privacy scope
When you register on sdtoto and use our platform, we collect personal data including your name, date of birth, email address, phone number, and payment account information. This data is used to create and manage your account, process deposits and withdrawals through your chosen payment method (DANA, OVO, GoPay, ShopeePay, LinkAja, QRIS, BCA, Mandiri, BRI, or BNI), comply with legal and regulatory obligations, prevent fraud and money laundering, and improve our service. For a comprehensive description of what data we collect, how we use it, how long we retain it, and your rights, please refer to our privacy policy on this site.
We collect gaming data (games played, bets placed, outcomes, session duration) to provide the service, detect fraud, and understand player behaviour for product improvement. We collect payment data (deposit amounts, payment method, timestamp, verification status) for transaction processing and anti-money-laundering (AML) compliance. We do not sell your personal data to third parties outside our operations and regulatory workflows. All third-party processors we engage are contractually bound to protect your data.
KYC (Know-Your-Customer) data collected during account verification includes copies of your government-issued ID and proof of address. This data is encrypted and stored separately from your gaming profile in a secure vault. We use KYC data to verify your identity, confirm your age, and comply with anti-fraud and financial regulations. We retain KYC data for the period required by applicable law (typically 5–7 years) for regulatory audit and dispute resolution; after that period, it is securely deleted unless legal hold applies.
Contact for legal inquiries
If you have legal questions about sdtoto's compliance with local law, jurisdiction policy, terms of service, privacy practices, or regulatory status, you can contact our legal and compliance team. Our primary contact channel is email. Please send your enquiry to our support email address and mark the subject line "Legal Inquiry" or "Compliance Question" for proper routing. We aim to respond to legal enquiries within 5 business days with either a direct answer or a note that we require further investigation.
For urgent or sensitive compliance matters, you may use our live-chat support to request an escalation to our compliance officer. Live-chat response times vary by time of day; we typically respond within 1–2 hours during standard business hours and within 24 hours outside business hours. If your matter requires a formal legal opinion or written response, we will direct you to submit your enquiry by email so our legal team can prepare a thorough, documented reply.
If you believe sdtoto is operating illegally or in breach of applicable law in your jurisdiction, you may report your concern to the relevant regulatory authority in your jurisdiction. You may also report concerns directly to sdtoto via email, and we will escalate your report to our compliance officer for investigation and response. We do not retaliate against users who report genuine legal or compliance concerns in good faith.